The vulnerability allows a malicious project to define a bogus golang.org/fips140 module and, by controlling a GOMODPROXY, serve an arbitrary module that satisfies the toolchain’s trust checks. The build process unpacks the trusted ziphash for the bundled golang.org/fips140 module and constructs its entry in the GOMODCACHE, effectively bypassing checksum verification. An attacker can therefore inject arbitrary code that runs during a Go build, compromising confidentiality, integrity, and potentially availability of the built binary.

Go toolchain cmd/go is affected. No specific version information is provided; the issue applies to any installation of the Go toolchain that accepts modules from a user‑defined GOMODPROXY and verifies their checksum packages.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the CVSS score of 6.7 indicates a medium severity. The impact is still high: an attacker can ship code that executes during compilation. The likely attack vector is an environment where the build user selects or is directed to a malicious GOMODPROXY, allowing the attacker to host the forged golang.org/fips140 module. Despite the medium CVSS rating, the potential for arbitrary code execution warrants a high risk assessment.